CVE-2013-4584: Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the S...

Security readout for executives and security teams

Perdition before 2.2 may not enforce configured cipher restrictions on outbound IMAP or POP STARTTLS connections. In plain terms, a mail proxy could use weaker encryption than administrators intended. The source bundle does not show active exploitation or a CVSS score, so urgency depends on whether legacy Perdition is still deployed. Exposure is most likely in legacy environments running Perdition before 2.2 as an IMAP or POP proxy, especially where STARTTLS is used for outbound connections and ssl_outgoing_ciphers is relied on to restrict weak ciphers. Treat this as a targeted legacy mail infrastructure hygiene item. It is not supported by evidence of active exploitation in the bundle, but it can undermine encryption policy where old Perdition proxies remain in production. Mitigation focus: Upgrade Perdition to version 2.2 or later where feasible.; Review Debian, Red Hat, or vendor package guidance for fixed builds.; Avoid relying on affected STARTTLS cipher policy behavior in older Perdition versions..

Prepared

Jun 6, 2026, 04:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.